You really, really want to avoid artifact to begin with, but you're confusing the IdP's artifact endpoint with the SP's, not the same thing. The SP sends the full URL to respond to in the request, and for that reason it shouldn't be an artifact response anyway. -- Scott